Sunturai
Back to results
MediumSigmaHQNasreddine Bencherchali (Nextron Systems) +1

Cscript/Wscript Potentially Suspicious Child Process

Detects potentially suspicious child processes of Wscript/Cscript. These include processes such as rundll32 with uncommon exports or PowerShell spawning rundll32 or regsvr32. Malware such as Pikabot and Qakbot were…

Description

Detects potentially suspicious child processes of Wscript/Cscript. These include processes such as rundll32 with uncommon exports or PowerShell spawning rundll32 or regsvr32. Malware such as Pikabot and Qakbot were seen using similar techniques as well as many others.

Detection logic

Detection requirements

Log source product
windows
Log source category
process_creation

Known benign triggers

  • Some false positives might occur with admin or third party software scripts. Investigate and apply additional filters accordingly.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice